Sigma rule: Legitimate Application Dropped Script

Rule

Title

Legitimate Application Dropped Script

Status

test

Level

high

Author

frack113, Florian Roth (Nextron Systems)

Date

2022-08-21

Modified

2026-05-11

File

rules/windows/file/file_event/file_event_win_susp_legitimate_app_dropping_script.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects LOLBINs and applications that should not legitimately drop script files to disk.
This may indicate malware staging or abuse of a trusted binary for script-based code execution.

Log source

product

windows

category

file_event

Detection

selection:
    Image|endswith:
        # Microsoft Office Programs Dropping Executables / Rest of the apps are covered in: c7a74c80-ba5a-486e-9974-ab9e682bc5e4
        - \eqnedt32.exe
        - \wordpad.exe
        - \wordview.exe
        # LOLBINs that can be used to download executables
        - \certutil.exe
        - \certoc.exe
        - \CertReq.exe
        # - \bitsadmin.exe (depends on the environment; comment in if you're sure that bitsadmin doesn't do that in your env)
        - \Desktopimgdownldr.exe
        - \esentutl.exe
        # - \expand.exe
        - '\mshta.exe'
        # Executables that should never drop an executable to disk (but may after a previous process injection or if it's malware that uses a legitimate name)
        - '\AcroRd32.exe'
        - '\RdrCEF.exe'
        - '\hh.exe'
        - '\finger.exe'
    TargetFilename|endswith:
        - '.bat'
        - '.chm'
        - '.csproj'
        - '.hta'
        - '.js'
        - '.jse'
        - '.proj'
        - '.ps1'
        - '.py'
        - '.scf'
        - '.vbe'
        - '.vbs'
        - '.wsf'
        - '.wsh'
filter_main_mshta:
    Image|endswith: '\mshta.exe'
    TargetFilename|endswith: '.hta'
condition: selection and not 1 of filter_main_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.stealth
• attack.t1218

MITRE ATT&CK ids this rule names

• T1218

References

• https://github.com/Neo23x0/sysmon-config/blob/3f808d9c022c507aae21a9346afba4a59dd533b9/sysmonconfig-export-block.xml#L1326
• https://dmpdump.github.io/posts/TelegramRat/
• https://www.virustotal.com/gui/file/a0d5b30578acd1df9139e7a8a4bfc659dc2cf48f4dc0c5804b70890adeb9fa21/behavior

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/file/file_event/file_event_win_susp_legitimate_app_dropping_script.yml